Answering Trade-Off Questions Like a Senior

"localStorage or memory for the access token?"
  AXIS   : durability of the credential after an XSS
  BOTH   : localStorage survives reload but hands over a portable credential;
           memory dies on reload and needs a refresh call on boot
  COMMIT : memory, plus refresh-on-boot — an XSS can act while the tab is open
           but cannot steal something usable tomorrow
  CHANGE : a client with no refresh endpoint, or an offline-first app

"Do you need MFA?"
  AXIS   : account-takeover risk against signup and login friction
  BOTH   : MFA stops credential stuffing dead; it also costs conversion and
           generates recovery support load
  COMMIT : mandatory for admins and anything touching money, optional for
           consumer accounts, with passkeys offered as the low-friction path
  CHANGE : a compliance requirement, or a measured takeover rate

"Microservices: verify at the edge or everywhere?"
  AXIS   : latency and duplication against internal blast radius
  BOTH   : edge-only is fast and assumes the network is perfect; verify-
           everywhere costs microseconds and assumes nothing
  COMMIT : verify at the edge AND re-sign a short internal token that every
           service verifies — normalisation plus real internal checks
  CHANGE : a service mesh already giving mTLS workload identity might let me
           lean on that for the service half, but not for the user half

"Rate limit per IP or per account?"
  AXIS   : which attack you are stopping
  BOTH   : per-IP stops one noisy machine and punishes corporate NAT;
           per-account stops distributed stuffing and can be used to lock
           someone out
  COMMIT : both, with exponential backoff rather than hard lockout
  CHANGE : if lockout were a compliance requirement, add it with an
           out-of-band unlock path

"Build or buy the auth server?"
  AXIS   : control against the cost of operating a security-critical system
  BOTH   : building fits it to your model exactly; it also means you own
           key rotation, protocol conformance and every CVE
  COMMIT : buy, unless there is a specific requirement no provider meets
  CHANGE : extreme scale economics, data residency, or an air-gapped
           deployment

# You will be asked something you do not know. The recovery is scored.

❌ Bluffing
   "Yes, DPoP is basically mTLS for browsers."
   → Half-right sounds worse than not knowing, and invites a follow-up you
     cannot survive.

❌ Shutting down
   "I don't know."
   → True, and it ends the thread with nothing.

✅ Bound what you know, reason from it, ask
   "I haven't implemented DPoP. I know the category — sender-constrained
    tokens, so possession of the token alone isn't enough. I'd expect the
    client to hold a key and sign per-request proofs, with the token carrying
    a thumbprint the resource server checks. Is that roughly right, and is it
    the browser case you're interested in or service-to-service?"

   → You demonstrated the concept, reasoned to a plausible mechanism, and
     turned it into a conversation. That often scores higher than the
     candidate who had memorised it.

✅ Bring it back to something you have done
   "I've solved the adjacent problem — we kept access tokens in memory so a
    stolen one wasn't portable. Sender-constraining sounds like the stronger
    version of the same goal."

# Interviewers are explicitly assessing calibration: do you know what you
# know? A candidate who never says 'I'm not sure' is a risk, not an asset.

# Answer each in under two minutes, out loud. Gaps show up immediately.

FUNDAMENTALS
  □ authn vs authz, and why 401 vs 403 changes client behaviour
  □ why the server can never trust a client-supplied user id
  □ what TLS does and does not give you

SESSIONS & TOKENS
  □ the five questions that decide sessions vs tokens
  □ four ways to revoke a JWT, with the delay and cost of each
  □ every check a verify call must perform, and why aud matters
  □ algorithm confusion: the attack and the one-line fix
  □ refresh rotation, reuse detection, and the parallel-refresh bug

CROSS-ORIGIN
  □ origin vs site, and which one cookies care about
  □ what triggers a preflight
  □ why wildcard + credentials is refused
  □ debugging a dropped cookie, in order
  □ why bearer tokens have no CSRF

OAUTH
  □ why OAuth is not authentication
  □ what state and PKCE each defend against
  □ why implicit and ROPC were removed
  □ the access-token-as-login vulnerability

SENIOR
  □ sender-constrained tokens: DPoP vs mTLS binding
  □ token exchange, and impersonation vs delegation
  □ where auth belongs in a microservice estate
  □ multi-tenant isolation, and why the tenant comes from the credential
  □ what fails when the IdP is down — and why never fail open

DESIGN
  □ design an auth service in 45 minutes
  □ state a revocation delay as a number and justify it
  □ say what you would not build

# Anything you cannot answer aloud in two minutes, you do not know yet.
# Reading is not the same as retrieval.